From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:35438) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fXYBZ-0005Eu-Jv for guix-patches@gnu.org; Mon, 25 Jun 2018 16:34:07 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fXYBW-0007pj-DI for guix-patches@gnu.org; Mon, 25 Jun 2018 16:34:05 -0400 Received: from debbugs.gnu.org ([208.118.235.43]:55635) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1fXYBW-0007p7-9Y for guix-patches@gnu.org; Mon, 25 Jun 2018 16:34:02 -0400 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1fXYBW-0006n9-0y for guix-patches@gnu.org; Mon, 25 Jun 2018 16:34:02 -0400 Subject: [bug#31967] [PATCH] gnu: libtiff: Fix CVE-2018-{8905,10963}. Resent-Message-ID: Received: from eggs.gnu.org ([2001:4830:134:3::10]:35314) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fXYAw-0005Bn-Lm for guix-patches@gnu.org; Mon, 25 Jun 2018 16:33:28 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fXYAt-0007O9-7c for guix-patches@gnu.org; Mon, 25 Jun 2018 16:33:26 -0400 Received: from new4-smtp.messagingengine.com ([66.111.4.230]:40861) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1fXYAs-0007Nx-UG for guix-patches@gnu.org; Mon, 25 Jun 2018 16:33:23 -0400 Received: from jasmine.lan (unknown [12.232.82.154]) by mail.messagingengine.com (Postfix) with ESMTPA id 7C2F3E461E for ; Mon, 25 Jun 2018 16:33:21 -0400 (EDT) From: Leo Famulari Date: Mon, 25 Jun 2018 16:32:58 -0400 Message-Id: List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-patches-bounces+kyle=kyleam.com@gnu.org Sender: "Guix-patches" To: 31967@debbugs.gnu.org * gnu/packages/patches/libtiff-CVE-2018-8905.patch, gnu/packages/patches/libtiff-CVE-2018-10963.patch: New files. * gnu/local.mk (dist_patch_DATA): Add them. * gnu/packages/image.scm (libtiff)[replacement]: New field. (libtiff/fixed): New variable. --- gnu/local.mk | 2 + gnu/packages/image.scm | 12 ++++ .../patches/libtiff-CVE-2018-10963.patch | 40 ++++++++++++ .../patches/libtiff-CVE-2018-8905.patch | 61 +++++++++++++++++++ 4 files changed, 115 insertions(+) create mode 100644 gnu/packages/patches/libtiff-CVE-2018-10963.patch create mode 100644 gnu/packages/patches/libtiff-CVE-2018-8905.patch diff --git a/gnu/local.mk b/gnu/local.mk index 9d8947d55..1b39bf4e9 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -883,6 +883,8 @@ dist_patch_DATA = \ %D%/packages/patches/libtheora-config-guess.patch \ %D%/packages/patches/libtiff-CVE-2017-9935.patch \ %D%/packages/patches/libtiff-CVE-2017-18013.patch \ + %D%/packages/patches/libtiff-CVE-2018-8905.patch \ + %D%/packages/patches/libtiff-CVE-2018-10963.patch \ %D%/packages/patches/libtool-skip-tests2.patch \ %D%/packages/patches/libusb-0.1-disable-tests.patch \ %D%/packages/patches/libusb-for-axoloti.patch \ diff --git a/gnu/packages/image.scm b/gnu/packages/image.scm index a2874be1a..5ad6fe948 100644 --- a/gnu/packages/image.scm +++ b/gnu/packages/image.scm @@ -394,6 +394,7 @@ extracting icontainer icon files.") (define-public libtiff (package (name "libtiff") + (replacement libtiff/fixed) (version "4.0.9") (source (origin @@ -426,6 +427,17 @@ collection of tools for doing simple manipulations of TIFF images.") "See COPYRIGHT in the distribution.")) (home-page "http://www.simplesystems.org/libtiff/"))) +(define libtiff/fixed + (package + (inherit libtiff) + (source + (origin + (inherit (package-source libtiff)) + (patches + (append (origin-patches (package-source libtiff)) + (search-patches "libtiff-CVE-2018-8905.patch" + "libtiff-CVE-2018-10963.patch"))))))) + (define-public leptonica (package (name "leptonica") diff --git a/gnu/packages/patches/libtiff-CVE-2018-10963.patch b/gnu/packages/patches/libtiff-CVE-2018-10963.patch new file mode 100644 index 000000000..d31c12399 --- /dev/null +++ b/gnu/packages/patches/libtiff-CVE-2018-10963.patch @@ -0,0 +1,40 @@ +Fix CVE-2018-10963: + +http://bugzilla.maptools.org/show_bug.cgi?id=2795 +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10963 + +Patch copied from upstream source repository: + +https://gitlab.com/libtiff/libtiff/commit/de144fd228e4be8aa484c3caf3d814b6fa88c6d9 + +From de144fd228e4be8aa484c3caf3d814b6fa88c6d9 Mon Sep 17 00:00:00 2001 +From: Even Rouault +Date: Sat, 12 May 2018 14:24:15 +0200 +Subject: [PATCH] TIFFWriteDirectorySec: avoid assertion. Fixes + http://bugzilla.maptools.org/show_bug.cgi?id=2795. CVE-2018-10963 + +--- + libtiff/tif_dirwrite.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/libtiff/tif_dirwrite.c b/libtiff/tif_dirwrite.c +index 2430de6d..c15a28db 100644 +--- a/libtiff/tif_dirwrite.c ++++ b/libtiff/tif_dirwrite.c +@@ -695,8 +695,11 @@ TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff) + } + break; + default: +- assert(0); /* we should never get here */ +- break; ++ TIFFErrorExt(tif->tif_clientdata,module, ++ "Cannot write tag %d (%s)", ++ TIFFFieldTag(o), ++ o->field_name ? o->field_name : "unknown"); ++ goto bad; + } + } + } +-- +2.17.0 + diff --git a/gnu/packages/patches/libtiff-CVE-2018-8905.patch b/gnu/packages/patches/libtiff-CVE-2018-8905.patch new file mode 100644 index 000000000..f49815789 --- /dev/null +++ b/gnu/packages/patches/libtiff-CVE-2018-8905.patch @@ -0,0 +1,61 @@ +Fix CVE-2018-8095: + +http://bugzilla.maptools.org/show_bug.cgi?id=2780 +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8905 + +Patch copied from upstream source repository: + +https://gitlab.com/libtiff/libtiff/commit/58a898cb4459055bb488ca815c23b880c242a27d + +From 58a898cb4459055bb488ca815c23b880c242a27d Mon Sep 17 00:00:00 2001 +From: Even Rouault +Date: Sat, 12 May 2018 15:32:31 +0200 +Subject: [PATCH] LZWDecodeCompat(): fix potential index-out-of-bounds write. + Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2780 / CVE-2018-8905 + +The fix consists in using the similar code LZWDecode() to validate we +don't write outside of the output buffer. +--- + libtiff/tif_lzw.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/libtiff/tif_lzw.c b/libtiff/tif_lzw.c +index 4ccb443c..94d85e38 100644 +--- a/libtiff/tif_lzw.c ++++ b/libtiff/tif_lzw.c +@@ -602,6 +602,7 @@ LZWDecodeCompat(TIFF* tif, uint8* op0, tmsize_t occ0, uint16 s) + char *tp; + unsigned char *bp; + int code, nbits; ++ int len; + long nextbits, nextdata, nbitsmask; + code_t *codep, *free_entp, *maxcodep, *oldcodep; + +@@ -753,13 +754,18 @@ LZWDecodeCompat(TIFF* tif, uint8* op0, tmsize_t occ0, uint16 s) + } while (--occ); + break; + } +- assert(occ >= codep->length); +- op += codep->length; +- occ -= codep->length; +- tp = op; ++ len = codep->length; ++ tp = op + len; + do { +- *--tp = codep->value; +- } while( (codep = codep->next) != NULL ); ++ int t; ++ --tp; ++ t = codep->value; ++ codep = codep->next; ++ *tp = (char)t; ++ } while (codep && tp > op); ++ assert(occ >= len); ++ op += len; ++ occ -= len; + } else { + *op++ = (char)code; + occ--; +-- +2.17.0 + -- 2.18.0